web-shader-extractor

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is an unlicensed, third-party GitHub repository from an individual account that the skill fetches on-demand (npx), which allows arbitrary code to be executed and matches multiple high-risk indicators for suspicious download sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install-on-demand step fetches and installs remote code at runtime via "npx skills add https://github.com/lixiaolin94/skills" which downloads and executes upstream code required for the skill, so the URL https://github.com/lixiaolin94/skills is a runtime external dependency that can execute remote code.